Threat briefs

CVE-2026-2328 describes a vulnerability where an unauthenticated remote attacker can exploit insufficient input validation to access backend components beyond their intended scope via path traversal, leading to the exposure of sensitive information.

The Tycoon2FA PhaaS platform, which facilitates MFA bypass and email account compromise, experienced a temporary decrease in activity following a takedown operation, but campaign volumes have since returned to pre-disruption levels, and TTPs remain consistent.

The aquasecurity/trivy-action GitHub Action was compromised via git tag repointing, injecting a multi-stage credential stealer into CI/CD pipelines, potentially exposing secrets, credentials, and infrastructure.

The trivy-action GitHub Action, a popular open-source vulnerability scanner used in CI/CD pipelines, was compromised via git tag repointing to inject a multi-stage credential stealer.

CrowdStrike introduces agentic MDR and SOC Transformation Services, combining deterministic automation, adaptive AI agents, and human oversight to enhance breach prevention and SOC modernization.

CrowdStrike's enhanced Cloud Native Application Protection Platform (CNAPP) improves risk prioritization by incorporating threat intelligence from groups like LABYRINTH CHOLLIMA and SCATTERED SPIDER, providing context on application-infrastructure dependencies, and identifying configuration changes leading to exposure.

CrowdStrike Falcon Cloud Security enhances its CNAPP capabilities, incorporating adversary intelligence to prioritize cloud risks based on threat actor behavior, particularly focusing on groups like LABYRINTH CHOLLIMA and SCATTERED SPIDER, to enable security teams to understand and remediate cloud exposures more effectively.

The trivy-action GitHub Action was compromised via git tag repointing, injecting a multi-stage credential stealer that ran before the legitimate scanner, impacting CI/CD pipelines.

CrowdStrike is introducing new capabilities to secure AI agents and govern shadow AI across endpoints, SaaS, and cloud environments by providing detection and response (AIDR) for desktop AI applications, discovery of AI-related components, and runtime security for agents built in Microsoft Copilot Studio to combat attacks like living off the AI land (LOTAIL) by securing the agentic interaction layer.

The Tycoon2FA phishing-as-a-service (PhaaS) platform, disrupted by law enforcement on March 4, 2026, has shown a resurgence in activity, enabling cybercriminals to bypass MFA and compromise email accounts using adversary-in-the-middle (AITM) techniques.

The Tycoon2FA phishing-as-a-service (PhaaS) platform, disrupted by law enforcement on March 4, 2026, has shown a resurgence in activity, enabling cybercriminals to bypass MFA and compromise email accounts using adversary-in-the-middle (AITM) techniques.

A supply chain attack compromised the trivy-action GitHub Action, a popular open-source vulnerability scanner used in CI/CD pipelines, with the attacker retroactively poisoning 76 of 77 release tags to steal credentials.

CrowdStrike's Falcon Cloud Security CNAPP capabilities provide risk-based insights, application-infrastructure interaction understanding, adversary-aligned risk prioritization, and configuration change tracing, utilizing threat intelligence on over 280 groups like LABYRINTH CHOLLIMA and SCATTERED SPIDER to prioritize risks based on TTPs, discovering shadow AI activity and preventing sensitive data exposure.

CrowdStrike's Falcon Next-Gen SIEM is expanding to support third-party EDR solutions, starting with Microsoft Defender, to unify detection, investigation, and response without requiring a Falcon sensor.

The aquasecurity/trivy-action GitHub Action was compromised via git tag repointing, injecting a multi-stage credential stealer into CI/CD pipelines, allowing for the theft of secrets and credentials.

CrowdStrike introduces agentic MDR and SOC Transformation Services combining deterministic automation, AI agents, and human accountability to accelerate breach response and modernize security operations.

CrowdStrike's Charlotte AI AgentWorks aims to enhance security operations by providing a platform for building and orchestrating AI-powered security agents, integrating with leading AI models and offering features like mission-ready agents and workflow automation to improve analyst efficiency and decision accuracy.

CrowdStrike enhances its CNAPP by incorporating adversary-informed risk prioritization, including application-layer analysis and correlation of cloud risks with threat actor profiles like LABYRINTH CHOLLIMA and SCATTERED SPIDER, to enable better risk understanding and remediation.

CrowdStrike introduces agentic MDR and SOC Transformation Services to enhance SOC capabilities with AI and automation, emphasizing data foundations, workflows, and governance for improved detection and response across diverse environments.

The Tycoon2FA Phishing-as-a-Service platform, used to bypass MFA and compromise email accounts, has demonstrated resilience following a law enforcement takedown, with campaign activity returning to pre-disruption levels and TTPs remaining consistent.

The aquasecurity/trivy-action GitHub Action was compromised via git tag repointing, where 76 of 77 release tags were retroactively poisoned with malicious code that executes a multi-stage credential theft operation.

CrowdStrike Falcon Cloud Security introduces new CNAPP capabilities including Application Explorer and adversary intelligence to prioritize cloud risks based on threat actor behavior, enabling security teams to focus on documented intrusion patterns by groups like LABYRINTH CHOLLIMA and SCATTERED SPIDER.

GitLab CE/EE versions 14.3 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 are vulnerable to improper authorization checks in Jira Connect installations, allowing an authenticated user with minimal workspace permissions to obtain installation credentials and impersonate the GitLab application.

Xiongmai DVR/NVR devices are vulnerable to root OS command injection (CVE-2026-34005) due to shell metacharacters in the HostName value, exploitable via an authenticated DVRIP request, potentially allowing arbitrary command execution with root privileges.

The openclaw package versions 2026.3.24 and earlier are vulnerable due to the gateway plugin subagent fallback `deleteSession` function dispatching `sessions.delete` with a synthetic `operator.admin` runtime scope, potentially leading to unauthorized session deletion.

The openclaw package versions 2026.3.24 and earlier are vulnerable due to the gateway plugin subagent fallback `deleteSession` function dispatching `sessions.delete` with a synthetic `operator.admin` runtime scope, potentially leading to unauthorized session deletion.

OpenClaw versions 2026.3.24 and earlier are vulnerable to Server-Side Request Forgery (SSRF) because of unguarded configured base URLs in multiple channel extensions, allowing attackers to potentially access internal resources.

A remote, unauthenticated attacker can bypass Traefik deny rules by sending malformed gRPC requests with a missing leading slash in the `:path` pseudo-header, exploiting a vulnerability in the gRPC-Go dependency, leading to unauthorized access if a fallback "allow" rule is configured.

A vulnerability in the antchfx/xpath package allows for denial of service via CPU exhaustion by exploiting boolean expressions that evaluate to true, leading to an infinite loop.

A stack-based buffer overflow vulnerability (CVE-2026-5046) in Tenda FH1201 version 1.2.0.14(408) allows remote attackers to execute arbitrary code by manipulating the GO argument in the formWrlExtraSet function of the /goform/WrlExtraSet component.